Merge "msm:camera:isp: fix array index bound checks" (869dc6e1) · Commits · e / devices / android_kernel_sony_msm8994

drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c

+36 −20

Original line number	Diff line number	Diff line
		@@ -368,8 +368,8 @@ int msm_isp_axi_check_stream_state(
		return -EINVAL;

		for (i = 0; i < stream_cfg_cmd->num_streams; i++) {
		if (HANDLE_TO_IDX(stream_cfg_cmd->stream_handle[i])
		> MAX_NUM_STREAM) {
		if (HANDLE_TO_IDX(stream_cfg_cmd->stream_handle[i]) >=
		MAX_NUM_STREAM) {
		return -EINVAL;
		}
		stream_info = &axi_data->stream_info[
		@@ -674,6 +674,8 @@ int msm_isp_request_axi_stream(struct vfe_device vfe_dev, void arg)
		&vfe_dev->axi_data, stream_cfg_cmd);
		if (rc) {
		pr_err("%s: Request validation failed\n", __func__);
		if (HANDLE_TO_IDX(stream_cfg_cmd->axi_stream_handle) <
		MAX_NUM_STREAM)
		msm_isp_axi_destroy_stream(&vfe_dev->axi_data,
		HANDLE_TO_IDX(stream_cfg_cmd->axi_stream_handle));
		return rc;
		@@ -745,11 +747,17 @@ int msm_isp_release_axi_stream(struct vfe_device vfe_dev, void arg)
		int rc = 0, i;
		struct msm_vfe_axi_stream_release_cmd *stream_release_cmd = arg;
		struct msm_vfe_axi_shared_data *axi_data = &vfe_dev->axi_data;
		struct msm_vfe_axi_stream *stream_info =
		&axi_data->stream_info[
		HANDLE_TO_IDX(stream_release_cmd->stream_handle)];
		struct msm_vfe_axi_stream *stream_info;
		struct msm_vfe_axi_stream_cfg_cmd stream_cfg;


		if (HANDLE_TO_IDX(stream_release_cmd->stream_handle) >=
		MAX_NUM_STREAM) {
		pr_err("%s: Invalid stream handle\n", __func__);
		return -EINVAL;
		}
		stream_info = &axi_data->stream_info[
		HANDLE_TO_IDX(stream_release_cmd->stream_handle)];
		if (stream_info->state == AVALIABLE) {
		pr_err("%s: Stream already released\n", __func__);
		return -EINVAL;
		@@ -1066,6 +1074,11 @@ static void msm_isp_process_done_buf(struct vfe_device *vfe_dev,
		uint8_t drop_frame = 0;
		memset(&buf_event, 0, sizeof(buf_event));

		if (stream_idx >= MAX_NUM_STREAM) {
		pr_err("%s: Invalid stream_idx", __func__);
		return;
		}

		frame_id = vfe_dev->axi_data.
		src_info[SRC_TO_INTF(stream_info->stream_src)].frame_id;

		@@ -1232,8 +1245,8 @@ static void msm_isp_update_camif_output_count(
		return;

		for (i = 0; i < stream_cfg_cmd->num_streams; i++) {
		if (HANDLE_TO_IDX(stream_cfg_cmd->stream_handle[i])
		> MAX_NUM_STREAM) {
		if (HANDLE_TO_IDX(stream_cfg_cmd->stream_handle[i]) >=
		MAX_NUM_STREAM) {
		return;
		}
		stream_info =
		@@ -1532,8 +1545,8 @@ static int msm_isp_axi_update_cgc_override(struct vfe_device *vfe_dev,
		return -EINVAL;

		for (i = 0; i < stream_cfg_cmd->num_streams; i++) {
		if (HANDLE_TO_IDX(stream_cfg_cmd->stream_handle[i])
		> MAX_NUM_STREAM) {
		if (HANDLE_TO_IDX(stream_cfg_cmd->stream_handle[i]) >=
		MAX_NUM_STREAM) {
		return -EINVAL;
		}
		stream_info = &axi_data->stream_info[
		@@ -1564,8 +1577,8 @@ static int msm_isp_start_axi_stream(struct vfe_device *vfe_dev,
		return -EINVAL;

		for (i = 0; i < stream_cfg_cmd->num_streams; i++) {
		if (HANDLE_TO_IDX(stream_cfg_cmd->stream_handle[i])
		> MAX_NUM_STREAM) {
		if (HANDLE_TO_IDX(stream_cfg_cmd->stream_handle[i]) >=
		MAX_NUM_STREAM) {
		return -EINVAL;
		}
		stream_info = &axi_data->stream_info[
		@@ -1648,8 +1661,8 @@ static int msm_isp_stop_axi_stream(struct vfe_device *vfe_dev,
		return -EINVAL;

		for (i = 0; i < stream_cfg_cmd->num_streams; i++) {
		if (HANDLE_TO_IDX(stream_cfg_cmd->stream_handle[i])
		> MAX_NUM_STREAM) {
		if (HANDLE_TO_IDX(stream_cfg_cmd->stream_handle[i]) >=
		MAX_NUM_STREAM) {
		return -EINVAL;
		}
		stream_info = &axi_data->stream_info[
		@@ -1913,8 +1926,8 @@ int msm_isp_update_axi_stream(struct vfe_device vfe_dev, void arg)
		for (i = 0; i < update_cmd->num_streams; i++) {
		update_info = &update_cmd->update_info[i];
		/check array reference bounds/
		if (HANDLE_TO_IDX(update_info->stream_handle)
		> MAX_NUM_STREAM) {
		if (HANDLE_TO_IDX(update_info->stream_handle) >=
		MAX_NUM_STREAM) {
		return -EINVAL;
		}
		stream_info = &axi_data->stream_info[
		@@ -2079,7 +2092,9 @@ void msm_isp_process_axi_irq(struct vfe_device *vfe_dev,
		comp_info = &axi_data->composite_info[i];
		wm_mask &= ~(comp_info->stream_composite_mask);
		if (comp_mask & (1 << i)) {
		if (!comp_info->stream_handle) {
		stream_idx = HANDLE_TO_IDX(comp_info->stream_handle);
		if ((!comp_info->stream_handle) \|\|
		(stream_idx >= MAX_NUM_STREAM)) {
		pr_err("%s: Invalid handle for composite irq\n",
		__func__);
		continue;
		@@ -2115,12 +2130,13 @@ void msm_isp_process_axi_irq(struct vfe_device *vfe_dev,

		for (i = 0; i < axi_data->hw_info->num_wm; i++) {
		if (wm_mask & (1 << i)) {
		if (!axi_data->free_wm[i]) {
		stream_idx = HANDLE_TO_IDX(axi_data->free_wm[i]);
		if ((!axi_data->free_wm[i]) \|\|
		(stream_idx >= MAX_NUM_STREAM)) {
		pr_err("%s: Invalid handle for wm irq\n",
		__func__);
		continue;
		}
		stream_idx = HANDLE_TO_IDX(axi_data->free_wm[i]);
		stream_info = &axi_data->stream_info[stream_idx];
		ISP_DBG("%s: stream id %x frame id: 0x%x\n", __func__,
		stream_info->stream_id, stream_info->frame_id);